EP3789902A1 - Sichere, mit einer sicheren, manipulationssicheren plattform operierende vorrichtung, zugehöriges system und computerprogrammprodukt - Google Patents

Sichere, mit einer sicheren, manipulationssicheren plattform operierende vorrichtung, zugehöriges system und computerprogrammprodukt Download PDF

Info

Publication number
EP3789902A1
EP3789902A1 EP20192085.7A EP20192085A EP3789902A1 EP 3789902 A1 EP3789902 A1 EP 3789902A1 EP 20192085 A EP20192085 A EP 20192085A EP 3789902 A1 EP3789902 A1 EP 3789902A1
Authority
EP
European Patent Office
Prior art keywords
hosts
virtual
internal
firmware
platform
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP20192085.7A
Other languages
English (en)
French (fr)
Other versions
EP3789902C0 (de
EP3789902B1 (de
Inventor
Amedeo Veneroso
Olivier Van Nieuwenhuyze
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Proton World International NV
STMicroelectronics SRL
Original Assignee
Proton World International NV
STMicroelectronics SRL
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Proton World International NV, STMicroelectronics SRL filed Critical Proton World International NV
Publication of EP3789902A1 publication Critical patent/EP3789902A1/de
Application granted granted Critical
Publication of EP3789902C0 publication Critical patent/EP3789902C0/de
Publication of EP3789902B1 publication Critical patent/EP3789902B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/86—Secure or tamper-resistant housings
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/14—Handling requests for interconnection or transfer
    • G06F13/36—Handling requests for interconnection or transfer for access to common bus or bus system
    • G06F13/362—Handling requests for interconnection or transfer for access to common bus or bus system with centralised access control
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/77—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in smart cards
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications

Definitions

  • Embodiments of the present disclosure relate to solutions of secure device operating with a secure tamper-resistant platform including a tamper-resistant hardware platform and a virtual primary platform operating with a low level operating system performing an abstraction of resources of the hardware platform, and a secondary platform with a high level operating system providing a further abstraction of resources to applications in which respective internal hosts are embedded, said secure device including an internal host domain including said hosts, said secure device including a plurality of physical and/or logical input/output interfaces through which externals hosts can access said internal hosts, said virtual primary platform being configured to set logical communication channels having as ends said externals hosts and said internal hosts.
  • Embodiments of the present disclosure relate in particular to an embedded or integrated SSP (Smart Secure Platform) device including secure elements for applications in the field of transportation, payment, access control, automotive digital key, eSIM, secure services, identity like ePassport or eID or mobile driving license or other digital services requiring a high security level for storing their asset(s) and/or credential(s).
  • SSP Smart Secure Platform
  • Embedded and Integrated SSP Smart Secure Platform
  • ETSI TS 103 465 V15.0.0 2019-05
  • Embedded SSP it is a standalone chip and integrated SSP it is an isolated chip integrated in a bigger CPU that may be used to converge services from different existing secure elements.
  • the corresponding several physical standalone chips are typically based on similar hardware and operating systems, having similar, but not identical features and requirements. This leads to the need for the convergence of such similar secure devices into a single one.
  • a single operating system has resulted to be too complex to manage all the requirements, in particular in terms of certifications, such as for payment applications and approval.
  • eSE NFC embedded Secure Element
  • a telecom secure element such as the eUICC instead needs to be tested by many Mobile Network Operators.
  • FIG 1 it is shown an architecture of a smart secure platform 10, which represents a tamper resistant element (TRE), which includes a hardware platform 11, and a primary platform 1P, specifically embodied by a Virtual Primary Platform 12 or VPP.
  • VPP tamper resistant element
  • the VPP 12 includes a low level operating system (LLOS) managing security-related hardware functions and native multiprocessing capabilities and services, managing the hardware functions related to communication and firmware management.
  • block 12 refers essentially to LLOS.
  • the VPP 12 also includes a block indicated with 12a including an ABI (Application Binary Interface) related to the implementation of the LLOS in order to map any API (Application Programming Interface) which are dependent of the programming language made available on a HLOS (High Level Operating System) which is in a secondary platform 2P accompanied by respective Virtual Primary Platform applications or VPP applications 14.
  • HLOS is an additional Program encompassed in a VPP Application, that provides further abstraction of resources and services to its HLOS applications 14.
  • a same HLOS can support several VPP Applications 14.
  • LLOS in block 12 is running in privileged CPU mode and it is minimal, containing only the functionality which cannot run in unprivileged CPU mode.
  • the LLOS shall include a kernel, i.e. block 12a, supporting the management of multiple Processes and in addition to a kernel, the LLOS shall support:
  • the LLOS in block 12 virtualizes the underlying hardware resources, i.e. represent an abstraction of the resources, and includes a respective VPP API which interacts with multiple VPP applications 14.
  • the secondary platform 2P of the VPP applications 14 it is also shown to include a firmware loader module 13, which is specifically the GlobalPlatform Open Firmware Loader (OFL) in the example, which standardizes how firmware can be loaded and managed in the tamper-resistant hardware platform 11, where as GlobalPlatform VPP platform 12 defines the security services for the tamper-resistant hardware platform 11 at the primary platform 1P.
  • OFL GlobalPlatform Open Firmware Loader
  • the Hardware Platform 11 is implemented in a TRE and may embed:
  • the hardware platform 11 should furthermore embed:
  • VPP network protocol As for instance specified in GlobalPlatform Technology Virtual Primary Platform - Network Protocol Version 1.0.1.
  • the VPP network protocol can setup pipes, i.e. a logical data circuit routing packet communication channel or channels between two gates of two different hosts within two different host Domains, with modem, Rich EE (REE), Trusted EE and other hosts.
  • a gate is an entry point of the pipe towards a service/application that is operated inside a host, which in turn is a logical entity that operates one or more gates.
  • FIG 2 it is shown schematically a network including a TRE host domain 23, including any host embedded in a VPP Application 14 in the tamper resistant element hardware platform 11 and external host domains 30 including:
  • legacy interfaces may be requested to be restricted to specific classes of VPP applications for security reasons.
  • the secure element needs to access to GPIO (General Input Output ports) pins to control user inputs and perform other functions.
  • GPIO General Input Output ports
  • Embodiments moreover concerns a related method for managing access to hosts as well as a corresponding related computer program product, loadable in the memory of at least one computer and including software code portions for performing the steps of the method when the product is run on a computer.
  • a computer program product is intended to be equivalent to reference to a computer-readable medium containing instructions for controlling a computer system to coordinate the performance of the method.
  • Reference to "at least one computer” is evidently intended to highlight the possibility for the present disclosure to be implemented in a distributed/modular fashion.
  • a secure device operating with a secure tamper-resistant platform including a tamper-resistant hardware platform and a virtual primary platform operating with a low level operating system performing an abstraction of resources of the hardware platform, and a secondary platform with a high level operating system providing a further abstraction of resources to applications in which respective internal hosts are embedded
  • said secure device including an internal host domain including said internal hosts, said secure device including a plurality of physical and/or logical input/output interfaces through which externals hosts can access said internal hosts, said virtual primary platform being configured to set interactions between said externals hosts and said internal hosts, wherein said internal host domain includes a further set of virtual hosts each configured to operate as a proxy between an input/output interface and an application, each input/output interface being configured to address only one among the virtual hosts.
  • said secured device is configured to perform a filtering including selecting specific virtual hosts able to set an interaction with an internal host embedded in a specific application and vice versa.
  • said interactions include logical communication channels having as ends said externals hosts and said internal hosts.
  • said filtering includes selecting specific virtual hosts able to set a logical communication channel with an internal host embedded in a specific application and vice versa.
  • said filtering includes accessing a whitelist on the basis of a firmware family identifier.
  • said whitelist is loaded with the loading of the firmware.
  • said firmware family identifier is obtained by a descriptor of the application
  • said firmware family identifier is an UUID descriptor.
  • said device is an embedded Smart Secure Platform device and said virtual primary platform is a GlobalPlatform Virtual Primary Platform.
  • said device is configured to verify the authorization of a specific firmware family identification request for a specific firmware during the loading of the firmware, in particular implemented by the TRE or its loader.
  • the present disclosure provides also solutions regarding a method for managing access between internal hosts and external host in a secure device, setting interactions between said externals hosts and said internal hosts, in particular logical communication channels having as ends externals hosts and internal hosts, according to any of the previous embodiments, including adding to said internal host domain a further set of virtual hosts each configured to operate as a proxy between an input/output interface and an application, addressing with each input/output interface only one among the virtual hosts.
  • the method includes filtering, selecting specific virtual hosts able to interact with an internal host embedded in a specific application and vice versa.
  • the method includes filtering includes registering a whitelist of the virtual hosts for a given application during the loading of the firmware of said application.
  • the said setting logical communication channels having as ends said externals hosts and said internal hosts sets said logical communication channels as including said virtual hosts selecting the ends on the basis of the proxy configuration of the virtual hosts and of the selection criteria specified in said filtering step, in particular by said step of registering a whitelist of the virtual hosts for a given application during the loading of the firmware of said application.
  • the present disclosure provides also solutions regarding a computer-program product that can be loaded into the memory of at least one processor and comprises portions of software code for implementing the method of any of the previous method embodiments.
  • the solution here described substantially provides adding in the tamper resistant element host domain a plurality of virtual hosts associated to the input/output interfaces of the tamper resistant element, a filtering mechanism of virtual hosts able to interact with an internal host embedded in a specific application, i.e. firmware instance, run in the tamper resistant element, and vice versa, being also provided.
  • FIG. 3 it is shown a schematic diagram representing a host domain 23, which represents the TRE host domain, which may correspond to the host domain of the Smart Secure Platform device 10, and is representative of internal hosts, embedded in an application which is run in the Smart Secure Platform device 10, specifically a VPP application.
  • a VPP application is an instance of a firmware on a VPP 12. Its use is case dependent and can run a High-Level Operating System (HLOS), i.e. an additional program encompassed in a VPP Application, that provides further abstraction, i.e. interface layer, of resources and services to its HLOS application or applications, and such HLOS application or applications.
  • HLOS High-Level Operating System
  • the VPP applications 14 1 , 14 2 which embed respective hosts.
  • external hosts 331 and 341 which are interfaced to the host domain 23 of the Smart Secure Platform device 10 by external interfaces 25, specifically an ISO interface 25 1 and a GPIO interface 25 2 .
  • the external host 331 corresponds to a modem, thus it corresponds to an host of Mobile Broadband Modem host domain 33, to which the first VPP applications 14 1 accesses through the ISO interface 25 1 and vice versa.
  • the external host 342 corresponds to a button, e.g. Sign-In Google button, in other words a control input accessing the second VPP application 14 1 through the GPIO interface 25 2 and vice versa.
  • the virtual primary platform 12 being configured to set interactions between the externals hosts and the internal hosts. By way of examples of such interactions are set pipes having as ends said externals hosts and said internal hosts.
  • a first pipe is represented by elements 331, 24 1 , 25 1 , 14 1
  • a second pipe is represented by elements 341, 24 2 , 25 2 , 14 2 .
  • each single input/output port i.e. external interface 25 addresses one virtual host 24 within the TRE host domain 23.
  • the LLOS of the VPP 12 has its host domain 23 added with virtual hosts 24, each of them being configured to operate as a proxy of a physical external input output interface 25, i.e. acts as intermediary for the requests or connections of physical external input output interfaces 25.
  • the virtual host 24 is then configured to direct the connection from the external interface 25 is then directed to a specific VPP Application 14.
  • virtual host domains can be defined and the virtual hosts 24 may be also assigned to one or also multiple virtual host domains.
  • the secure device 10 is also configured to implement a filtering mechanism, selecting the virtual hosts 24 able to interact with a given internal host 23 embedded in a specific application 14 and vice versa.
  • Such a filtering mechanism preferably exploits a whitelisting mechanism, i.e. explicitly allowing some virtual hosts 24 access to a specific internal host 23, in particular it may exploit the white-listing implemented in the VPP 12 in a virtual network protocol, as described in Virtual Primary Platform - Network Protocol - Public Release v1.0.
  • the network involves a collection of host domains, grouping hosts, as already described, according to functional perimeters, such as the TRE Host Domain, hosts, a network controller host and a router, which routes packets in pipes between hosts under the control of the network controller host.
  • a valid network is a collection of at least two hosts which are logically connected together and physically connected via the router to which the host has a static pipe.
  • the router is configured to maintain two separate whitelists, per each host, to filter access to the host on the basis of an host identifier and of a host domain identifier.
  • the router only routes packets from one host to another if the source host identifier is in the host whitelist of the destination host and if the source host domain identifier of the source host is in the host domain whitelist of the destination host. Empty whitelist prevents the host from receiving any packet from any other host.
  • the VPP 12 is then configured to identify a further virtual hosts white list WL of VPP applications at a firmware loading time by the OFL module 13, e.g. registering such further virtual hosts white list WL to the VPP Network Controller Host at the firmware loading time, in a way similar to the procedure like the one described in fig. 6.1.3 of Virtual Primary Platform - Network Protocol - Public Release v1.0.1, for the other host and host domain whitelists.
  • the application descriptor includes identifiers of the type Universal Unique Identifier (UUID), among which the Family Firmware Identifier, identifying that a particular Firmware belongs to a particular class of Firmware.
  • UUID Universal Unique Identifier
  • Such UUID may be used as a field identifying the application 14 in a related white list.
  • a whitelist WL can indicate the following:
  • the whitelist can be seen as a table, in particular a look-up table, which is accessed with an identifier of the VPP application 14 and returns the list of virtual hosts 25 associated to such VPP application 14, which must operate as proxy for the external interface 25 uniquely associated to it.
  • the UUID can be for instance the Firmware Family Identifier defined in OFL.
  • a new Firmware Family Identifier may be defined (e.g. Family_HWController) .
  • the white list corresponding to the Firmware Family Identifier Family_HWController for that identifier contains the GPIO Manager Virtual Host, 25 2 . All the other white lists are to be configured to be prevented to communicate to it, i.e. do not include GPIO Manager Virtual Host, 25 2 as accessible external host.
  • the Family identifier is a number written in the firmware that has two impacts:
  • NID indicates the identifier, OEM domain.name is the Fully Qualified Domain Name (FQDN) of the company or Original Equipment Manufacture defining the host 23 of the application 14, for instance the domain name of a telecom company, [SDO domain.name] defines the FQDN of a standards development organization or an industry forum, such as GlobalPlatform (globalplatform.org).
  • FQDN Fully Qualified Domain Name
  • SDO domain.name defines the FQDN of a standards development organization or an industry forum, such as GlobalPlatform (globalplatform.org).
  • NSS is the Use Case name, e.g. "keyless entry service”.
  • FIG. 4 which represents an embodiment of the method here described, given a secure device 10 operating with a secure tamper-resistant platform including a tamper-resistant hardware platform 11 and a virtual primary platform 12 operating with a low level operating system performing an abstraction of resources of the hardware platform 11, and a secondary platform 2P with a high level operating system providing a further abstraction of resources to applications 14 in which respective internal hosts 23 are embedded, said secure device 10 including an internal host domain 23 including said internal hosts 23, said secure device 10 including a plurality of input/output interfaces 25, which can be physical and/or logical interfaces, through which externals hosts 311, 341 can access said internal hosts 23, a method 500 for managing access between internal hosts and external host by setting logical communication channels P having as ends said externals hosts, e.g.
  • 311, 341 and said internal hosts 23 includes the steps of providing 510 a further set of virtual hosts 24 each configured to operate as a proxy between an input/output interface 25 and an application 14, each input/output interface 25 addressing only one among the virtual hosts 24, filtering 520, selecting specific virtual hosts 25 able to interact with an internal host 23 embedded in a specific application 14 and vice versa.
  • Said filtering step includes a step 525 of registering a whitelist WL of the virtual hosts for a given application during the loading of the firmware of said application.
  • Such loading of the firmware may take place before or after step 110 of providing a further set of virtual hosts 24
  • the method 500 of figure 4 may include a specific step of providing such secure device 10 before step 510 of providing the virtual hosts 23.
  • the SET WHITELIST command (specifically LINK_SET_HOST_WHITELIST as per par. 5.3.2.5 of GlobalPlatform Technology Virtual Primary Platform - Network Protocol Version 1.0.1.) may be issued (or received) by the VPP application 14 1 .
  • the solution here described provides that the virtual network protocol intercepts the SET WHITELIST command and filters it or not depending on the whitelist configuration; then, the traditional white list mechanism by VPP virtual network protocol is applied.
  • the method 500 for managing access between internal hosts and external host following steps finally sets logical communication channels P in a step 530.
  • Such setting step of logical communication channels P having as ends said externals hosts 311, 341 and said internal hosts 23 sets such logical communication channels including the virtual hosts 25 provided in step 510 a selecting the ends on the basis of the proxy configuration of the virtual hosts and of the selection criteria specified in the filtering step 520, in particular by the whitelisting step 125, registering a whitelist of the virtual hosts for a given application during the loading of the firmware of said application.
  • the device here described may be configured to verify the authorization of a specific firmware family identification request for a specific firmware during the loading of the firmware, by way of example implemented by the TRE or its loader.
  • the embodiment just described allows, in particular compared to eSSP, limited or no impact on handset components and support of association of physical interfaces to VPP applications. Also the solution allows using the VPP application to isolate services one with respect to the other
  • the filtering mechanism can be different from the whitelist mechanism. For instance, for filtering the virtual hosts able to interact with an internal host embedded in a specific application run in the tamper resistant element, a blacklisting mechanism can be implemented or the whitelisting can be implemented with no relationship with the VNP whitelist or with the Family Identifier.
  • the set of external interfaces 25 may include physical and/or logical interfaces, since the solution here described can be applied also when multiple hosts share a physical interface that has some logical management on top.
  • SWP Single Wire Protocol
  • HCI Host Controller interface
  • the virtual primary platform is configured to set interactions between said externals hosts and said internal hosts which may include that a pin is used for signal transmission only, e.g. the value on the pin could be only logical zero or logical one, or Set and Reset.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mathematical Physics (AREA)
  • Computing Systems (AREA)
  • Stored Programmes (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Storage Device Security (AREA)
  • Fittings On The Vehicle Exterior For Carrying Loads, And Devices For Holding Or Mounting Articles (AREA)
  • Steering Controls (AREA)
  • Toys (AREA)
EP20192085.7A 2019-09-06 2020-08-21 Sichere, mit einer sicheren, manipulationssicheren plattform operierende vorrichtung, zugehöriges system und computerprogrammprodukt Active EP3789902B1 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
IT102019000015827A IT201900015827A1 (it) 2019-09-06 2019-09-06 Dispositivo sicuro operante con una piattaforma sicura resistente alla manomissione, corrispondente sistema e prodotto informatico

Publications (3)

Publication Number Publication Date
EP3789902A1 true EP3789902A1 (de) 2021-03-10
EP3789902C0 EP3789902C0 (de) 2023-07-19
EP3789902B1 EP3789902B1 (de) 2023-07-19

Family

ID=69173260

Family Applications (1)

Application Number Title Priority Date Filing Date
EP20192085.7A Active EP3789902B1 (de) 2019-09-06 2020-08-21 Sichere, mit einer sicheren, manipulationssicheren plattform operierende vorrichtung, zugehöriges system und computerprogrammprodukt

Country Status (4)

Country Link
US (1) US11514197B2 (de)
EP (1) EP3789902B1 (de)
CN (1) CN112464222B (de)
IT (1) IT201900015827A1 (de)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240232439A1 (en) * 2018-05-11 2024-07-11 Lattice Semiconductor Corporation Tamper detection systems and methods for programmable logic devices

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12050692B2 (en) * 2019-10-30 2024-07-30 John A. Nix Secure and flexible boot firmware update for devices with a primary platform
DE102021110142A1 (de) * 2021-04-21 2022-10-27 Bundesdruckerei Gmbh Personalisieren eines Sicherheitsapplets auf einem mobilen Endgerät
US20240265152A1 (en) * 2023-02-08 2024-08-08 Stmicroelectronics International N.V. Embedded secure circuit
US20250217521A1 (en) * 2024-01-02 2025-07-03 Texas Instruments Incorporated Detection of and response to tamper events

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140317686A1 (en) * 2013-04-22 2014-10-23 Oracle International Corporation System with a trusted execution environment component executed on a secure element

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007092651A2 (en) * 2006-01-04 2007-08-16 Nytor, Inc. Trusted host platform
US10387219B2 (en) * 2015-03-10 2019-08-20 Oracle International Corporation Enabling multiple secure elements in a card computing device
CN108509251B (zh) * 2018-03-19 2022-03-11 沈阳微可信科技有限公司 一种适用于可信执行环境中的安全虚拟化系统
US20200162247A1 (en) * 2018-11-15 2020-05-21 Iot And M2M Technologies, Llc Secure firmware transfer from a server to a primary platform

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140317686A1 (en) * 2013-04-22 2014-10-23 Oracle International Corporation System with a trusted execution environment component executed on a secure element

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"Smart Cards; Smart Secure Platform (SSP); Requirements Specification", vol. SCP REQ, no. V15.0.0, 16 May 2019 (2019-05-16), pages 1 - 52, XP014344461, Retrieved from the Internet <URL:http://www.etsi.org/deliver/etsi_ts/103400_103499/103465/15.00.00_60/ts_103465v150000p.pdf> [retrieved on 20190516] *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240232439A1 (en) * 2018-05-11 2024-07-11 Lattice Semiconductor Corporation Tamper detection systems and methods for programmable logic devices

Also Published As

Publication number Publication date
EP3789902C0 (de) 2023-07-19
IT201900015827A1 (it) 2021-03-06
US11514197B2 (en) 2022-11-29
US20210073425A1 (en) 2021-03-11
EP3789902B1 (de) 2023-07-19
CN112464222A (zh) 2021-03-09
CN112464222B (zh) 2024-06-28

Similar Documents

Publication Publication Date Title
EP3789902B1 (de) Sichere, mit einer sicheren, manipulationssicheren plattform operierende vorrichtung, zugehöriges system und computerprogrammprodukt
US9572025B2 (en) Method, server, computer program and computer program product for communicating with secure element
US9342470B2 (en) System for enabling software in storage-capable devices
US10528749B2 (en) Methods and apparatus for containerized secure computing resources
CN210666775U (zh) 用于嵌入式通用集成电路卡的防篡改设备和电子设备
US20160044498A1 (en) Host device coupled to a mobile phone and method of operating the same
US9875366B2 (en) Microprocessor system with secured runtime environment
US20100185874A1 (en) Method of Mass Storage Memory Management for Large Capacity Universal Integrated Circuit Cards
KR20130012243A (ko) 특수 권한 기반의 내장 ｓｉｍ의 ｍｎｏ 변경방법 및 그를 위한 내장 ｓｉｍ과 기록매체
CN103455349B (zh) 应用程序访问智能卡的方法和装置
KR20070095231A (ko) 메모리 카드의 이용을 제어하기 위한 장치 및 방법
US8844827B2 (en) Chip card, and method for the software-based modification of a chip card
US10387681B2 (en) Methods and apparatus for controlling access to secure computing resources
CN114499918B (zh) 安全元件和方法
CN114513294B (zh) 安全元件和方法
CN106385314A (zh) 数据隔离系统、方法及利用数据隔离系统的方法
JP2005149394A (ja) 情報処理装置および情報処理方法、プログラム、並びに記録媒体
JP2005085266A (ja) マイクロプロセッサ周辺装置アクセス制御
US20260101184A1 (en) Method, configuration program, application program dataset, computer-readable data carrier as well as server device for providing access to information provided in security credentials
US11838985B2 (en) Policy-based management of embedded subscriber identity module (eSIM) profiles
EP4134858A1 (de) Verwaltung von applikationen auf mehreren sicheren elementen
CN112685722A (zh) 一种调用ip的方法和系统
CN114490108A (zh) 安全元件和方法
CN104820792A (zh) Android设备及数据通道系统权限管理方法和装置
CN120602910A (zh) eSIM的配置处理方法、装置、设备、介质及程序产品

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20210902

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04W 12/37 20210101ALI20230314BHEP

Ipc: H04W 12/00 20210101ALI20230314BHEP

Ipc: G06F 21/77 20130101ALI20230314BHEP

Ipc: G06F 21/71 20130101AFI20230314BHEP

INTG Intention to grant announced

Effective date: 20230328

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602020013968

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

U01 Request for unitary effect filed

Effective date: 20230801

U07 Unitary effect registered

Designated state(s): AT BE BG DE DK EE FI FR IT LT LU LV MT NL PT SE SI

Effective date: 20230808

U20 Renewal fee for the european patent with unitary effect paid

Year of fee payment: 4

Effective date: 20230822

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231020

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231119

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231019

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231119

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231020

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602020013968

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230831

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20240422

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230821

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230821

U20 Renewal fee for the european patent with unitary effect paid

Year of fee payment: 5

Effective date: 20240723

U1N Appointed representative for the unitary patent procedure changed after the registration of the unitary effect

Representative=s name: BUZZI, NOTARO & ANTONIELLI D'OULX S.P.A.; IT

U1H Name or address of the proprietor changed after the registration of the unitary effect

Owner name: STMICROELECTRONICS BELGIUM; BE

Owner name: STMICROELECTRONICS S.R.L.; IT

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20240821

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20240821

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20200821

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20200821

U20 Renewal fee for the european patent with unitary effect paid

Year of fee payment: 6

Effective date: 20250723

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719